CEH Introduction to Ethical Hacking — All Questions With Answers

Question 1

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 2

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Accepted Answer

Slow down the scan rate. Option C is correct because slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

Answer

Use random source ports

Answer

Use a decoy scan

Answer

Use fragmented packets

Question 3

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 4

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Accepted Answer

Maintaining Access. Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.

Answer

Scanning

Answer

Hiding Evidence

Answer

Cracking

Question 5

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 6

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Accepted Answer

Restrict access to the Engineering web server to only the Engineering VLAN.. Option D is correct because the Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Answer

Implement a password policy requiring complex passwords for all users.

Answer

Enable two-factor authentication on the web server.

Answer

Apply the latest security patches to the web server.

Question 7

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 8

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 9

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Accepted Answer

Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.. Option B is correct because the server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.

Answer

Use the PUT method to upload a malicious file directly to the web root.

Answer

Exploit the IIS WebDAV vulnerability to execute commands.

Answer

Attempt SQL injection in the login form to extract database credentials.

Question 10

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Question 11

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Question 12

Match each network protocol to its well-known port number.

Question 13

Match each IDS/IPS term to its meaning.

CEH Introduction to Ethical Hacking — All Questions With Answers

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Based on the exhibit, what type of attack is being attempted?

Exhibit

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Match each network protocol to its well-known port number.

Match each IDS/IPS term to its meaning.

CEH Introduction to Ethical Hacking — All Questions With Answers

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Based on the exhibit, what type of attack is being attempted?

Exhibit

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Match each network protocol to its well-known port number.

Match each IDS/IPS term to its meaning.